Proactive defense system based on truth virtual network, and method

Abstract

The invention discloses a proactive defense system based on a truth virtual network, and a method. The system comprises the following modules in signal circulation communication: an attack detection module, a tricking guidance module, a vulnerability simulation module, an attack isolation module, a behavior recording module, an intelligent analysis module, an attack playback module and an attack countering module. The implementation method of the proactive defense system based on the truth virtual network follows a D3I network proactive defense model, and the D3I network proactive defense model comprises the following modules in signal circulation communication: a detection module, a deception module, an inception module and a defense counterattack module. The proactive defense system realizes accurate identification of attackers, effectively tricks and isolates the attackers to be far away from real service networks, comprehensively records, playbacks and intelligently analyzes attackbehaviors and counterattacks the attackers more effectively.

Description

technical field [0001] The invention relates to a network defense system, in particular to an active defense system and method based on an authentic virtual network, which belongs to the technical field of network security. Background technique [0002] The harm caused by the leakage of sensitive data and personal information continues to expand, and fraudulent ransomware is raging on the Internet. Under this severe security situation, a comprehensive security defense system is required. However, the current security defense system faces the following common problems: [0003] 1) At present, various security products are used to detect attack threats in the network and maintain the safe operation of the network. However, these security measures generally can only play a specific role within a certain range, and lack effective data fusion and collaborative management mechanisms among each other. Faced with a lot of scattered information, users cannot fully and intuitively un...

AI Technical Summary

Problems solved by technology

Faced with a lot of scattered information, users cannot fully and intuitively understand system security vulnerabilities, overall attack status, and security protection effects, and cannot meet the needs of predicting system security vulnerabilities and implementing defensive measures in advance

[0004] 2) With the continuous change of attack methods, some advanced attacks are currently highly concealed. Traditional security protection methods rely more on static rules to detect attack events, and cannot deal with attacks using undisclosed vulnerabilities.

In other words, the larger the enterprise, the more complete the security system, and the more complicated the internal process of patching vulnerabilities, resulting in a longer defense gap period

During this window time, the attacker can completely use the vulnerability to carry out internal network attack translation, and establish a covert control channel in other locations. At this time, the entire network becomes untrustworthy. Vulnerability patching can only prevent subsequent attacks. For successful attacks Meaningless

[0006] 4) Due to the restrictions of relevant legal provisions, offensive and defensive technology has become a highly sensitive area, resulting in a large loss of talents with actual offensive and defensive combat experience

At present, traditional security vendors pay too much attention to terminal defense in their understanding of security attack and defense, and have no idea of ​​the current attack and defense situation of traditional core enterprise intranets.

[0007] 5) The level of information security technology of media practitioners is uneven, and reports related to information security incidents often mislead the general public and even corporate security managers

[0008] 6) Not daring to face up to the existence of loopholes, resulting in a large number of repeated security constructions limited to border defenses, trying to create an unbreakable system, but not paying enough attention to internal network security threats

[0009] 7) Insufficient understanding of the concept of network attacks makes most security management equipment unable to play their due role, and even become a security risk when used improperly

[0011] 1) Based on the judgment of rules and experience, once an unknown safety problem occurs, it cannot be effectively dealt with;

[0012] 2) It is difficult to accurately identify the attacker and comprehensively record the attack path of the attacker;

[0013] 3) Based on passive defense technology, it is difficult to effectively induce attackers to stay away from real business systems;

[0014] 4) In the offensive and defensive confrontation, it is impossible to effectively counter the attacker, and it is difficult to achieve effective traceability

Images